This brings up a window just fine when a user's logged on - but it runs totally silently if it's run while the PC is at the login screen. I'm certain it's running because the debug log file referred to by $debugHandle is being written.

Is there any way of making that window appear when the PC is at the login screen?

Click "Add" button and browse to your program and then click "ok" then Click "Ok" again.

then just copy the registry entry created and install that on all PCs.

This does run and does throw up the GUI. Now, how to prevent a user interacting with the PC while this is going on? BlockInput() seems to need to run in a loop, which is annoying because nothing else in the app does....

This way the whole screen is totally covered, the login window can't easily be typed into and cannot be brought to the top. And because you're running before an interactive session has begun, the user can't use Ctrl-Alt-Delete to bring up task manager.

Now, how to deploy the local policy to 50 client PCs when I don't have the benefit of AD.....